[PATCH 3/3] malloc: Remove currently broken memory tagging

Florian Weimer fweimer@redhat.com
Fri May 8 16:44:13 GMT 2026


* Adhemerval Zanella Netto:

> On 08/05/26 13:29, Florian Weimer wrote:
>> * Yury Khrustalev:
>> 
>>> Have you run it on a system that has HWCAP2_MTE? One thing that doesn't
>>> work is that calling free(ptr) results in a SIGSEGV if ptr is tagged and
>>> memory it points to is also tagged. But of course for this to happen the
>>> system should have HWCAP2_MTE, and Glibc (or your test) should do prctl
>>> syscall with PR_SET_TAGGED_ADDR_CTRL and then malloc should use mmap with
>>> PROT_MTE.
>> 
>> The HWCAP2 bit was set, and the prctl call succeeded.  It was definitely
>> was not easy to get this point, though.
>> 
>>> If you manage to enable memory tagging in malloc correctly, a lot of
>>> malloc tests from the Glibc testsuite fail (due to similar segfaults
>>> resulting from tag mismatch).
>> 
>> I went back to my old notes, and found this (regarding test failures in
>> particular):
>> 
>> | There's some issue with the static startup code, and ldconfig from our
>> | RPM builds crashes (seems compiler flags dependent).  The glibc debug
>> | malloc is completely broken because it calls mem2chunk on null
>> | pointers, for free(NULL) and realloc(NULL, size).  That's not valid in
>> | MTE mode.  Rebooting with MTE forced on in glibc (for dynamically
>> | linked binaries) resulted in a crash in lvm.  But it was not as bad as
>> | I expected: podman and Go seem to be working.
>
> Was podman podmad built with gccgo or golang? If the latter it does not
> give us much information about memory tagging status since afaik golang
> binaries do not use libc malloc.

This was our build which uses OpenSSL cryptography and therefore links
against glibc as well.

Thanks,
Florian



More information about the Libc-alpha mailing list